BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1351 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 17777, name: syz-executor.5 2 locks held by syz-executor.5/17777: #0: ffff88801d88e078 (&ids->rwsem){++++}-{3:3}, at: semctl_down+0x2f/0x9f0 ipc/sem.c:1605 #1: ffff888026ac0158 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #1: ffff888026ac0158 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x25f/0xc60 arch/x86/mm/fault.c:1334 irq event stamp: 4492 hardirqs last enabled at (4491): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (4491): [] _raw_spin_unlock_irqrestore+0x42/0x50 kernel/locking/spinlock.c:191 hardirqs last disabled at (4492): [] __call_rcu kernel/rcu/tree.c:2964 [inline] hardirqs last disabled at (4492): [] call_rcu+0x312/0x710 kernel/rcu/tree.c:3038 softirqs last enabled at (4000): [] asm_call_irq_on_stack+0xf/0x20 softirqs last disabled at (3991): [] asm_call_irq_on_stack+0xf/0x20 CPU: 0 PID: 17777 Comm: syz-executor.5 Not tainted 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 ___might_sleep.cold+0x21b/0x261 kernel/sched/core.c:7911 do_user_addr_fault+0x29c/0xc60 arch/x86/mm/fault.c:1351 handle_page_fault arch/x86/mm/fault.c:1450 [inline] exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1506 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:580 RIP: 0010:kasan_record_aux_stack+0x77/0xb0 mm/kasan/generic.c:341 Code: 48 f7 fe 8b 47 24 49 89 f0 48 29 d3 8d 70 ff 41 0f af f0 48 01 ce 48 39 f3 48 0f 46 f3 e8 81 e9 ff ff bf 00 08 00 00 48 89 c3 <8b> 40 08 89 43 0c e8 1e e6 ff ff 89 43 08 5b c3 48 8b 50 08 48 c7 RSP: 0018:ffffc900021b7c10 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888078000000 RDX: 0000000000000078 RSI: ffff888078000000 RDI: 0000000000000800 RBP: ffffffff837ef3a0 R08: 0000000000400000 R09: 000000000000002e R10: ffffffff8132b7ea R11: 000000000000003f R12: 0000000000035b40 R13: ffff888078000088 R14: ffffc900021b7d30 R15: 0000000000000200 __call_rcu kernel/rcu/tree.c:2965 [inline] call_rcu+0xbb/0x710 kernel/rcu/tree.c:3038 ipc_rcu_putref+0x83/0xb0 ipc/util.c:505 freeary+0x139c/0x1b30 ipc/sem.c:1188 semctl_down+0x74e/0x9f0 ipc/sem.c:1625 ksys_semctl.constprop.0+0x260/0x2a0 ipc/sem.c:1696 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e149 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffa82f50c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000042 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e149 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007ffd9698948f R14: 00007ffa82f519c0 R15: 000000000119bf8c BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 6855e067 P4D 6855e067 PUD 65486067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 17777 Comm: syz-executor.5 Tainted: G W 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kasan_record_aux_stack+0x77/0xb0 mm/kasan/generic.c:341 Code: 48 f7 fe 8b 47 24 49 89 f0 48 29 d3 8d 70 ff 41 0f af f0 48 01 ce 48 39 f3 48 0f 46 f3 e8 81 e9 ff ff bf 00 08 00 00 48 89 c3 <8b> 40 08 89 43 0c e8 1e e6 ff ff 89 43 08 5b c3 48 8b 50 08 48 c7 RSP: 0018:ffffc900021b7c10 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888078000000 RDX: 0000000000000078 RSI: ffff888078000000 RDI: 0000000000000800 RBP: ffffffff837ef3a0 R08: 0000000000400000 R09: 000000000000002e R10: ffffffff8132b7ea R11: 000000000000003f R12: 0000000000035b40 R13: ffff888078000088 R14: ffffc900021b7d30 R15: 0000000000000200 FS: 00007ffa82f51700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000023b31000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __call_rcu kernel/rcu/tree.c:2965 [inline] call_rcu+0xbb/0x710 kernel/rcu/tree.c:3038 ipc_rcu_putref+0x83/0xb0 ipc/util.c:505 freeary+0x139c/0x1b30 ipc/sem.c:1188 semctl_down+0x74e/0x9f0 ipc/sem.c:1625 ksys_semctl.constprop.0+0x260/0x2a0 ipc/sem.c:1696 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e149 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffa82f50c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000042 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e149 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007ffd9698948f R14: 00007ffa82f519c0 R15: 000000000119bf8c Modules linked in: CR2: 0000000000000008 ---[ end trace b1463d3b4027af49 ]--- RIP: 0010:kasan_record_aux_stack+0x77/0xb0 mm/kasan/generic.c:341 Code: 48 f7 fe 8b 47 24 49 89 f0 48 29 d3 8d 70 ff 41 0f af f0 48 01 ce 48 39 f3 48 0f 46 f3 e8 81 e9 ff ff bf 00 08 00 00 48 89 c3 <8b> 40 08 89 43 0c e8 1e e6 ff ff 89 43 08 5b c3 48 8b 50 08 48 c7 RSP: 0018:ffffc900021b7c10 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888078000000 RDX: 0000000000000078 RSI: ffff888078000000 RDI: 0000000000000800 RBP: ffffffff837ef3a0 R08: 0000000000400000 R09: 000000000000002e R10: ffffffff8132b7ea R11: 000000000000003f R12: 0000000000035b40 R13: ffff888078000088 R14: ffffc900021b7d30 R15: 0000000000000200 FS: 00007ffa82f51700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000023b31000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400